|
|
|
In this hybrid WAN scenario, the CNA system optimizing VPN traffic sits on the “inside” of your network, behind any firewalls and VPN gateways. In this location, the CNA system has access to full routing information through both the private WAN and the Internet VPN.
Instead of just configuring links for the multiple service providers as presented in configuration examples for multi-homed Internet connections, you need to configure one link to represent your private WAN and another link to represent your VPN, then define site-links for both paths to the same site.
The CNA system needs to peer with the device that is in a position to choose between the alternate routes between your headquarters LAN and the remote site, and the CNA system needs to associate each link with that router. As noted previously, this device could be either a concentrator that acts as a proxy for all VPN tunnels, or a router that allows direct site-link optimization.
In either case, your VPN should be able to handle routing to all prefixes within your remote network without help.
But, since the CNA system has overridden your routing protocol, the WAN router’s BGP table will not contain any prefix other than what the CNA system asserts to it. The only prefix that the CNA system knows about is the prefix targeted by the active probe--unless you create a performance group and add to it each prefix that is located in your remote-site network (including the prefix that contains the probe target).
To get traffic to either the 172.28.4.0/24 or 172.28.5.0/24 networks in addition to the 172.28.3.0/24 network that contains the active probe target, you will need to create a performance group, as follows:
performance-group vpn 172.28.3.0/24 performance-group vpn 172.28.4.0/24 performance-group vpn 172.28.5.0/24
|
|
|